a7bbd5ad19a8a722a57c921dcd61de8e639e2cbc03d97134e17f4c796badcab0

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GMCRY.exe
Size 64KB
Sample260809-ab4khsz1cs
SHA256 a7bbd5ad19a8a722a57c921dcd61de8e639e2cbc03d97134e17f4c796badcab0
MD5 89aa72a7830d02cfe3da2488bcfabf82
SHA1 685a5e9fd92207f538d63e93c5dff610f58d49c7
SHA512 857eabfe2ac7aa1b05354d65c574fcf6817160c4a09d805388bbe7b85b237155e722e6eaa4f688927a560f902d03d6810b0f0c0584223bfe9585687dc613155a
SSDEEP 1536:hvZgPPtzJ6qleE2nWsb/80RTvsozY3bliTjVv:hvWtF6qleESWsb/80vsTbliTjB
TLSH
T1CC53F80577F88A05F1BE5B79CEB281404776B9929936D70E0DDA68CE0523F108DE2BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README.txt

Ransom Note

============================================ YOUR FILES ARE ENCRYPTED ============================================ All your files have been encrypted with military-grade AES-256 encryption. To decrypt your files, you need the GMCRYDecryptor.exe which should be on your desktop. Run it and enter the decryption key. Contact us to get the decryption key: Telegram: @b8gmk Discord: ccvtrojan DO NOT: - Restart your computer - Delete any .gmcry files - Try to rename or move files If you do not decrypt within 24 hours, your files may be lost. ============================================

Signatures

Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "1"	GMCRYDecryptor.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	GMCRY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\GMCRY = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	GMCRY.exe

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "0"	GMCRYDecryptor.exe

Disables Task Manager via registry modification
defense_evasion

Disables cmd.exe use via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "0"	GMCRYDecryptor.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "cmd.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "cmd.exe"	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	GMCRYDecryptor.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	GMCRYDecryptor.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	GMCRY.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	GMCRYDecryptor.exe

Creates a file in the Startup directory 1 TTPs 3 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GMCRY.lnk	cscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GMCRY.vbs	GMCRY.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\gmcry.vbs	taskmgr.exe

Executes dropped EXE 1 IoCs

pid	Process
5828	GMCRYDecryptor.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\GMCRY = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	GMCRY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GMCRY = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	GMCRY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GMCRY = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	GMCRY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\GMCRY = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	GMCRY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce\GMCRY = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	GMCRY.exe

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
45	discord.com
46	discord.com
55	discord.com
61	discord.com
77	discord.com
121	discord.com

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	GMCRYDecryptor.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	GMCRYDecryptor.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
5848	cscript.exe
4364	cscript.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gmcry_wallpaper.bmp"	GMCRY.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\Wallpaper	GMCRYDecryptor.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	GMCRY.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1724	cmd.exe
3044	cmd.exe
5460	cmd.exe
5624	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GMCRY.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GMCRYDecryptor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4324	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5336	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307074405171747"	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{ED9B4AC4-B2FF-45BD-8372-8AF7763F0992}	msedge.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\AddToPlaylistVLC\command	GMCRYDecryptor.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\AddToPlaylistVLC	GMCRYDecryptor.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	GMCRY.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4692	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1628	schtasks.exe
1524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
5828	GMCRYDecryptor.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe
4820	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	taskmgr.exe
Token: SeSystemProfilePrivilege	2956	taskmgr.exe
Token: SeCreateGlobalPrivilege	2956	taskmgr.exe
Token: SeDebugPrivilege	3820	GMCRY.exe
Token: 33	2956	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2956	taskmgr.exe
Token: SeDebugPrivilege	5828	GMCRYDecryptor.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
3820	GMCRY.exe
3820	GMCRY.exe
2956	taskmgr.exe
3820	GMCRY.exe
3820	GMCRY.exe
2956	taskmgr.exe
3820	GMCRY.exe
3820	GMCRY.exe
2956	taskmgr.exe
3820	GMCRY.exe
3820	GMCRY.exe
2956	taskmgr.exe
3820	GMCRY.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
3820	GMCRY.exe
3820	GMCRY.exe
3820	GMCRY.exe
3820	GMCRY.exe
3820	GMCRY.exe
3820	GMCRY.exe
3820	GMCRY.exe
3820	GMCRY.exe
3820	GMCRY.exe
3820	GMCRY.exe
3820	GMCRY.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe
2956	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 5848	3820	GMCRY.exe	87
PID 3820 wrote to memory of 4364	3820	GMCRY.exe	90
PID 3820 wrote to memory of 5460	3820	GMCRY.exe	93
PID 3820 wrote to memory of 5624	3820	GMCRY.exe	95
PID 3820 wrote to memory of 1724	3820	GMCRY.exe	97
PID 5460 wrote to memory of 1628	5460	cmd.exe	99
PID 1724 wrote to memory of 1740	1724	cmd.exe	100
PID 5624 wrote to memory of 744	5624	cmd.exe	101
PID 5460 wrote to memory of 1524	5460	cmd.exe	102
PID 1724 wrote to memory of 1688	1724	cmd.exe	103
PID 5624 wrote to memory of 924	5624	cmd.exe	104
PID 1724 wrote to memory of 4040	1724	cmd.exe	105
PID 5624 wrote to memory of 3064	5624	cmd.exe	106
PID 5624 wrote to memory of 5772	5624	cmd.exe	107
PID 3820 wrote to memory of 4820	3820	GMCRY.exe	118
PID 4820 wrote to memory of 5824	4820	msedge.exe	119
PID 4820 wrote to memory of 4324	4820	msedge.exe	121
PID 4820 wrote to memory of 2124	4820	msedge.exe	122
PID 4820 wrote to memory of 2124	4820	msedge.exe	122
PID 4820 wrote to memory of 2124	4820	msedge.exe	122
PID 4820 wrote to memory of 2476	4820	msedge.exe	123
PID 4820 wrote to memory of 2476	4820	msedge.exe	123
PID 4820 wrote to memory of 2564	4820	msedge.exe	124
PID 4820 wrote to memory of 2564	4820	msedge.exe	124
PID 4820 wrote to memory of 2564	4820	msedge.exe	124
PID 4820 wrote to memory of 992	4820	msedge.exe	125
PID 4820 wrote to memory of 992	4820	msedge.exe	125
PID 4820 wrote to memory of 992	4820	msedge.exe	125
PID 4820 wrote to memory of 3268	4820	msedge.exe	126
PID 4820 wrote to memory of 3268	4820	msedge.exe	126
PID 4820 wrote to memory of 3268	4820	msedge.exe	126
PID 4820 wrote to memory of 2328	4820	msedge.exe	127
PID 4820 wrote to memory of 2328	4820	msedge.exe	127
PID 4820 wrote to memory of 2328	4820	msedge.exe	127
PID 4820 wrote to memory of 2224	4820	msedge.exe	131
PID 4820 wrote to memory of 2224	4820	msedge.exe	131
PID 4820 wrote to memory of 5208	4820	msedge.exe	132
PID 4820 wrote to memory of 5208	4820	msedge.exe	132
PID 4820 wrote to memory of 5208	4820	msedge.exe	132
PID 4820 wrote to memory of 5860	4820	msedge.exe	135
PID 4820 wrote to memory of 5860	4820	msedge.exe	135
PID 4820 wrote to memory of 5104	4820	msedge.exe	136
PID 4820 wrote to memory of 5104	4820	msedge.exe	136
PID 3820 wrote to memory of 1192	3820	GMCRY.exe	138
PID 4820 wrote to memory of 4120	4820	msedge.exe	140
PID 4820 wrote to memory of 4120	4820	msedge.exe	140
PID 4820 wrote to memory of 4120	4820	msedge.exe	140
PID 4820 wrote to memory of 3680	4820	msedge.exe	141
PID 4820 wrote to memory of 3680	4820	msedge.exe	141
PID 4820 wrote to memory of 3680	4820	msedge.exe	141
PID 4820 wrote to memory of 2044	4820	msedge.exe	143
PID 4820 wrote to memory of 4848	4820	msedge.exe	144
PID 4820 wrote to memory of 4848	4820	msedge.exe	144
PID 4820 wrote to memory of 5680	4820	msedge.exe	145
PID 4820 wrote to memory of 5680	4820	msedge.exe	145
PID 4820 wrote to memory of 1952	4820	msedge.exe	146
PID 4820 wrote to memory of 1952	4820	msedge.exe	146
PID 4820 wrote to memory of 1448	4820	msedge.exe	147
PID 4820 wrote to memory of 1448	4820	msedge.exe	147
PID 4820 wrote to memory of 2644	4820	msedge.exe	148
PID 4820 wrote to memory of 2644	4820	msedge.exe	148
PID 5828 wrote to memory of 1452	5828	GMCRYDecryptor.exe	153
PID 5828 wrote to memory of 992	5828	GMCRYDecryptor.exe	155
PID 5828 wrote to memory of 3044	5828	GMCRYDecryptor.exe	158

C:\Users\Admin\AppData\Local\Temp\GMCRY.exe
"C:\Users\Admin\AppData\Local\Temp\GMCRY.exe"
1⤵
- Adds policy Run key to start application
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\System32\cscript.exe" "C:\Users\Admin\AppData\Local\Temp\gmcry_shortcut.vbs"
  2⤵
  - Creates a file in the Startup directory
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:5848
- C:\Windows\SysWOW64\cscript.exe
  "C:\Windows\System32\cscript.exe" "C:\Users\Admin\AppData\Local\Temp\gmcry_shortcut.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:4364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gmcry_task.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "GMCRY" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe" /sc onlogon /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "GMCRYUpdate" /tr "C:\Users\Admin\AppData\Roaming\svchost.exe" /sc onidle /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gmcry_install.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:744
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - System Location Discovery: System Language Discovery
    PID:924
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3064
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gmcry_block.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1740
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableCMD /t REG_DWORD /d 1 /f
    3⤵
    - Disables cmd.exe use via registry modification
    - System Location Discovery: System Language Discovery
    PID:1688
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Disables RegEdit via registry modification
    - System Location Discovery: System Language Discovery
    PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/users/ccvtrojan
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x364,0x7ffb312ac188,0x7ffb312ac194,0x7ffb312ac1a0
    3⤵
    PID:5824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,4112802465985408853,16322618534921408699,524288 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,11264021347313876975,5421672092711543526,262144 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:2
    3⤵
    PID:2124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,12369515347062412927,5036915769598003179,524288 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,13247635678962937660,16630425888472941773,2097152 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
    3⤵
    PID:2564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,4492907310371013273,244835933957413293,2097152 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,4362482022343528352,2430186740878722469,2097152 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,5922064002838707159,5835453987415263637,2097152 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,6699368906149941795,9242254102157503695,524288 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
    3⤵
    PID:2224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5236,i,16032021883302408012,8354061671047927481,2097152 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:5208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,9835987985499067297,2280987829031470046,524288 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,16626217402892433131,3350779737413497797,524288 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:8
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5956,i,17692679276473048436,16690325234368760207,2097152 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3720,i,11925027246153212916,5537121337763671389,2097152 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
    3⤵
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,4545869690386578953,13497937055899941731,524288 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,4545869690386578953,13497937055899941731,524288 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,2085302922651662091,9803944408603122761,524288 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,5713841395493664478,2642894679080772141,524288 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
    3⤵
    PID:5680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,4286434961482210971,11984239616419128644,524288 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,11392567532020566369,6829843632358970590,524288 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,15442715256576039723,10750990296171471711,524288 --field-trial-handle=2472,i,15756346658143437679,2631604686876351339,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
    3⤵
    PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/b8gmk
  2⤵
  PID:1192

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Creates a file in the Startup directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4728

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\README.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4692

C:\Users\Admin\Desktop\GMCRYDecryptor.exe
"C:\Users\Admin\Desktop\GMCRYDecryptor.exe"
1⤵
- Modifies visibility of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Executes dropped EXE
- Indicator Removal: Clear Persistence
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5828
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /tn "GMCRY" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1452
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /tn "GMCRYUpdate" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\gmcry_selfdel.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3044
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

GMCRY.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GMCRY.lnk
Size 872B
SHA256 4d573834b328c6aa17b91cf0282b2879f90f636f837b57a3d8ee340f91cd0976
MD5 4295c204f0328615c620e1c2ed431956
SHA1 fdde219097169a8da851af9ffce632f4a5f688d4
SHA512 1d93115776fddf7de824fa7b2f8ded742de082b3c1fa9fc2d55186057f74bc345599955c6e86c05a2b5f9f8cbfab0807534506fa1ae20e958b66ba36fd98b140
TLSH
T1EF118B584D992B31E3F2CB7043D61321C6352C41FFA61F0A0042C1492468D20FDA5F2B
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ca4ac85fa9af9d400600502f608a3f8d8bb73aef8a60227135f105dbe1ac2307
MD5 fd67f6c669d512d4f5409397f5166524
SHA1 57fe9fe38f3185ffaf45d9ead615bedb1359e4ef
SHA512 33fb3eb9c722b4610f37fb197d6c1b499a01cc5837317c4a96cf987a38080a355b423a63a7605516c6e162ee005b1a8e5c3175e684731288f3db35ba4da31224
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
TLSH
T124B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 94f40511ea08a0b6a5296f0532f655edb1ff5b802568267057a10b9a850c3df9
MD5 1d5dfbc6f7dec6803aa8fc7ec805839e
SHA1 301f0013a4f8dff7ba9babad8791aa3ced8c30a0
SHA512 c72b47d1d5b8cbfb51273c5f54f380345f34c6234f6c4cb560c31768cb9b8965c22d1cff5b0f4f68e25ae5facfd1c5b91e33c6d09e6baea7aea919322ffd1514
TLSH
T1D8D023B4B42A75A1D72F00354430F150A26541737277938671554C0DEA7844497FAFFA
MD5 SHA1 SHA512 TLSH

Submit Download

3c2ae3eb-770a-4c52-aaa7-d39b121af112.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3c2ae3eb-770a-4c52-aaa7-d39b121af112.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f2e5434-0327-4d5e-af6f-93c6e23d0313.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f2e5434-0327-4d5e-af6f-93c6e23d0313.tmp
Size 30KB
SHA256 d15c6ef56c8ec03241f4aad179dccc27da5f258489a0d2df10eb2f5b63912e5b
MD5 71cb18c287408b595e9fa77f1441a101
SHA1 69b5422ce0ddb9e11c6db79bef849258ec7104de
SHA512 e78a3f4df0c570a7756edc29b4bcb343e57683e80cf18cf7ee093ef394f6581e89e85929aabbbbec1af243cf64ba8b3ded1856012fdd1ad90472bd9082342b39
SSDEEP 768:ylUZYGMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTeLlPZ4R1roVc0s:ylUZYGMWvg09ou1jageLZmROBs
TLSH
T156E20A2F680CCB7E4F844E9DEC2A6F963ED801CB5A584D5447EA884C02CB7EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ea55be6e881ca48adba7186a94a5e954cc4b0c216783e03d1fddf36c1f18a11e
MD5 5b66e8201a6d83430766c98f40792f1d
SHA1 ad157c260968aa8e9e3a76b58b83bd6af545f7fd
SHA512 416aa93f45cec442dee2a215e66d1b272b8b026476a184e534bfdda1bdb44f05740ea6a109000d524e1ade135c4d1845064df57504538e4731295fa0f735ce8c
SSDEEP 48:xJ0BgiPhWIGMhpa5JI77TK/jSCfZAppTfMT09cuqAUsQ:L0TbGMHamq/lGpgT0DH7Q
TLSH
T1B381A1E041598CC7EFB20631E8D2BE0AF4B18A798C370EE9D7464EBE2501B20C157B34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c4b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c4b2.TMP
Size 3KB
SHA256 e486d0b679a45c0e36c41dd59a09681d86cb0fd1987ea9b5dd672de456a9c965
MD5 d3e2df1cdc8dc51a86fd39ea219a891f
SHA1 158bf78fbeb1c38edc85948abaec45e7f0d864fa
SHA512 7d39d3edf71a1697a24e774b10641844235cf52cd671fc355c1dc04ac42123ffb961ab01f5c4dfbac8890adf2bb1c03a54f0ea92160d4439e8fb0753c2ea23a4
TLSH
T160616EF8414D0CC0EFA21230E8D19E0EF8F29EBA89770FC6E54856BE2505B60D14B330
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 23e7e0b860f2fecf19999755edebdd05aa4ea0ba75a728b782d55ae598943177
MD5 31bf0f5daf6a281a41d3f9efb12bd4eb
SHA1 c3639aad1abe04fab13cc6fb1466d54dcf786b3f
SHA512 32092e545a7f5e80f6a524e6cad0be18275c597a72497c85f7251368c0f33d786fb486fc87953fe6f66538bf136c352b31263ed9a37e9c46668a17c503ae734b
TLSH
T1DC51ADF7C3E8862DC91256F0AB146E1BCE6D1914431C3D2AC9D4AF5BA3E3871E24195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 679aa1f6867546c866355b771d208ea12d28e941410ddf6eee217572a307ef3a
MD5 dc15c69f34532ad891be617e58f4ffd6
SHA1 d76c539709c30d2e1589915dca22e5be5fb1684a
SHA512 a7a85cc156f6840d9c309e1cbaa8d1f8a082e29a10f96ff9d98e42bf40a0971a431f123b9ec296ae7eadb74461511ea848636e3fea71381f0b0737cff5edee37
SSDEEP 192:sxZiCRayM/jK1Ml8Mjt/fKsuWwEdpEm4HW6+WNzjvlXF/YH6K/yIgyJ:sxZnM7t/fKsuW3SHbnT/bO
TLSH
T18B42D812AA38A977CCDBD209F9557F53D6F50472E2900E54AAFCDA1C00E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 55f532efb992b6b03553b14fc76cc077aa6acee8920c1f76dc53d51bf3c5971a
MD5 945a0526719d9963c2d0450a1e20c916
SHA1 8224c10a5234f535411b7e7534df835f41bc2f76
SHA512 da5b1c6ab15d2191fd739f96341e1269bc75a1fa6d285b56807fa4f6774c3ba46333e8faac5a10119035e03c5390cd452ef4cfeeb900a2a0340ce2ae64deea8e
SSDEEP 192:sxZiCRayM/jK1Ml85jt/fKsFWpVDWrnVFMIdpEm4HW6+WNbyFfjvlXF/YnGYhsIT:sxZnMYt/fKsFWvDW7VSHb8jT/N+
TLSH
T19E62D816AA34A977CCDBC209F9457F63D6F9147292900D54AAFCDA1C00E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 4ce47926494a8f969a9474488abb58a02faa5d7c564056ed1ac6c22d3149fe57
MD5 cd742a9b60024dfc969d581ff494f97b
SHA1 bad57084753799c7229aa59bf594ed60fae3f4c8
SHA512 3b1edde51d3f1fc317c4eaa228612356185d17621220906116f16ac48acaf2948899eb08cbcc74f8b6ed2a30a11bab561ac93df0b7c426dadaf0fe929ba1593c
SSDEEP 96:KA1eK2AwZiKCsKHuz6OMEE+OUpl8u+KkL84+gmuRox+UKDKuaG8KLaL:E0VFFjnU
TLSH
T175D1F61672B602113C3D6A0C86D597AB8E8272637018646B7BED00B1DE67E21DFFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bf003abb1bab097dee524ca6b7016dccefd12d609b016248e739421dee239467
MD5 c512e475d0ad8866dc14901ea92f31ab
SHA1 8604ab06ca6fe3f3bb805a194912a447d8006632
SHA512 419f2234e31860d4b15932ea4a2eb047fdc30e384a4b323f91156822423d5aaa55939ab49ae08ab6a5c7872224aafad4796a7c4ec685c3ea66138fa201c14293
SSDEEP 384:nsZcI0sNENlq7R2zX5od+V8ykVVX9tJrOQ6yASwGM/onT741aVHXnTKwBODNZOCE:60ARqOD1/hOQWSnnT741a1XnewBKZOsw
TLSH
T159C249B1D4A86CF749E1E8C9A586F5136EA41073D69C1A5CE3F87B3C305F9B81316922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 cd8bbde4da89c01c0fff669cd2c7c6d1201fa0ce5a0e8f8ee317341bcd1f7430
MD5 f91e182ab8c578f1e6550db3927295c0
SHA1 39462a46ce878f2a7224010d8f375ececf125fb1
SHA512 afb324972123cf114a048ea3d53dbbb11274c7288abc8e4cdb37114ec82e1693c36c6721c09dfb8b4c5f20ba638eda213773ef6b7e4ecffe5c1931d1bf9df614
SSDEEP 384:nBZcIFsNENlqyR2zX5od+V8ykVVX9tJrOQ2nTKwBODNZOCLKDX:JF7RqOD1/hOQ2newBKZOsw
TLSH
T14E926C71A838AC765DE6B145F84B32538EF850B3E9C42F54E6FDAB1C0096698271FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 974904e8d8e48eb33c04d52262fbe8671961c99548d007f453fa6ef1f61dde08
MD5 5e24bcee7173b48360bacc23ca53c30e
SHA1 fcc5ff793bf8e871d29c7646ca071977029ba858
SHA512 d3e74ba2defcf35a259959ec4fbd3bc3a4879f9258728571f224de3056617037807fff2694026f48e4d94e427fdba179d1d04402c04c35fb231d11dcdc00345d
SSDEEP 384:zwsNE5lYbyBzX5od+V8ykVVX9tJrOJ23X:c/JOD1/hOJ23X
TLSH
T17E422A35B478EC7759E2B146F58B36638FA420B7D9842F94D6E85F0C009729C271F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c49399df02da5ca8004bb7b1ba4d47306f94bb0485f8c83af29f6f49b73d3d6e
MD5 1ac6f7fedcd5035954daad2f5800dc56
SHA1 66e6ef70f76f5faa8146bc4f4fa915914d5bdfdf
SHA512 5168020178bdb06a37e86a176a9694b91d5250ae0fa6682ca6143e60de6f1f6a80545f169178e761d96b013b80d7f75ba237098bce17e5ecdbeda70e00a12b91
SSDEEP 192:yONL61VWQmiUyu3gGX5Obd+j1jzorykaoX/aD315U6:yONL6WPgGX5od+V8ykVC55U6
TLSH
T1F202D935A8686CA78EE2BE4AB48737235FD5106BEA552F84D6FC1B1C009765C2307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c065de60fb3e293bb238ee3cb4472cd32eea9ca188609c8385ca35f37b9bd2c9
MD5 bb39535bff8491b0548d85f0bf528f82
SHA1 f2370c93e984ef4f72b0e02f64776bbc5e2c924a
SHA512 44548ae0ad3653cb8fd7ea9499a2eaade3d5a1821729a829cfe639b16756439ad9fcae36f23e8525b3f97de050e5abef2a002c3b0cf01ebd7034252a0ad5dc7e
SSDEEP 192:kJONd613WQmiUy23AGX5Obd+j1jzorykaoVX9ySJrOMjJrqd7U6:iONd64RAGX5od+V8ykVVX9tJrOk2U6
TLSH
T183120831A468EC675DE2B545F48732A39EE42077DD456F84D6F81F1C009769C271F82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c558c16-afa6-4330-9013-483c0c25a771.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7c558c16-afa6-4330-9013-483c0c25a771.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fdcdc1d3497694ed35c096e1aa1c803259a437627dbec91ee7afb40d4a8f973c
MD5 2a2125ab3907f1c5032c74509645e209
SHA1 9b847ebc4e43bbb0e26339c6f1274d2875298505
SHA512 10d046920e484bc378da7a4383cb36ba6628850fa632b33f638fa0b90daaac8a06feaa3e1789035fa3025e87775bda9b2a0aaa25495f48ab7e0097ac76fff40f
TLSH
T117410568B6E91108B3B76F5AAFF6A86D843EB9772E06D05E00110D4E0663A00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

337cbb12-7fa2-4a02-904b-acf74d47230e.tmp

Path C:\Users\Admin\AppData\Local\Temp\337cbb12-7fa2-4a02-904b-acf74d47230e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34b22dd9-6e14-4bee-8232-acec77cd0450.tmp

Path C:\Users\Admin\AppData\Local\Temp\34b22dd9-6e14-4bee-8232-acec77cd0450.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

gmcry_block.bat

Path C:\Users\Admin\AppData\Local\Temp\gmcry_block.bat
Size 368B
SHA256 8cdef703e4a3c9928b65aa830ba19ec6cc86e1d6bd3a0d14e29785d5ee14fb47
MD5 a0f868513a7ea2d28dc55726fa7c3f22
SHA1 43e9b041cf17c90f8b69b6c591ac4ed1ffce9aba
SHA512 b9996848f9bfcc2c1ae46fe8b683812eac080248b4f8b08bc3c8eb89e121cf6df0c44ed14b1302f019ea249a4fb010372d807121c7734a91bbf2bbf2070f3b80
TLSH
T129E04F30740496B3E6A1B624988F5812ABBBE7CB7810EB95699A2046483B189C23C9D7
MD5 SHA1 SHA512 TLSH

Submit Download

gmcry_install.bat

Path C:\Users\Admin\AppData\Local\Temp\gmcry_install.bat
Size 584B
SHA256 9f121c1ca8b03dee8ed56b4f20ded1e2b63f5f3c9830e498924e7e83d31dc5f0
MD5 186a7b6ba541c5b23d3d20f775b37c82
SHA1 fa144d8e97f80d8c3d8b40e1d3bab6779e5d3210
SHA512 a1e4faf06b0fcf963b80a876f1e326f640ef19db0356a0e20dadbac0943033bb7f9d27e01d91c9c16061c5c4e04299909cfc0e8d5bdcf82d090d8b2f96efca1f
TLSH
T139F02B01BA184721D2D56820E48BDC3736B723DBC044ABF62645D048402E26DCDFF3E7
MD5 SHA1 SHA512 TLSH

Submit Download

gmcry_selfdel.bat

Path C:\Users\Admin\AppData\Local\Temp\gmcry_selfdel.bat
Size 122B
SHA256 f33faeb2773d527db5107697803e5d3d1dae14e2755d9888ed8121ac37a47c85
MD5 bcb271a0c9a8c648000b5938ee90df09
SHA1 8ae98300897cbb39eabf0377d2e88f0da0794c6b
SHA512 977c5c6cdae231f23de080e5ae27fd1631da3dbc0e5a39a9e61644b8a6d4b596cceab811c0b5fe5632e855c99faecb2e3830e4c6aa253e6071df81c655f42ba6
TLSH
T18AB0921F30894A85028110E686BE609E52DE18D38C48F2C343C291ABEA8B039969BEC9
MD5 SHA1 SHA512 TLSH

Submit Download

gmcry_shortcut.vbs

Path C:\Users\Admin\AppData\Local\Temp\gmcry_shortcut.vbs
Size 271B
SHA256 8c9b97436249e8d350de770f522f3318546feae87d2e31f402c9557ed9a50aeb
MD5 716466bb86dc64baf8f36d513039ae68
SHA1 49189c150dfdec20cdd53a6f494b51a6e7f79f02
SHA512 b95bc4b71745bd1bef45b636d4160b70c57f80b6896d81ad6a794fbc341787da5607ca81e2486aabb5eaeaaf06aae54364d4ee6554e5795af68e701c426e5492
TLSH
T116D095957158C29FC003327302F3CE0DC5E1C1A53B07EE758A15CD8D7641444C9B6083
MD5 SHA1 SHA512 TLSH

Submit Download

gmcry_shortcut.vbs

Path C:\Users\Admin\AppData\Local\Temp\gmcry_shortcut.vbs
Size 255B
SHA256 e5b61331b7686d63d4b2482ef2c1eabea66c946b605f4b698c859e6e2b6c8562
MD5 f46294ee45b67dfd5e394da4c4f84cb9
SHA1 063c6c2bdf7752ea4c1c0067967658f12a0a48ec
SHA512 e762a1d33ee128fb100f6308a538adb8782ce124164986322856bff6bfc1ee95e17cd280d32c9db3f349dcdc3c2bd80f1f8d77f86d72cd172b8962ba831fbc78
TLSH
T190D09795B118C2DA800332A202B3CE0ECAD1C0AA3707DE768959CE4EB601944C9BA083
MD5 SHA1 SHA512 TLSH

Submit Download

gmcry_task.bat

Path C:\Users\Admin\AppData\Local\Temp\gmcry_task.bat
Size 220B
SHA256 258a7ff81b04ef5dd9b7c14c07105f6b90f1269a58dd03ddc44bd14bd020f887
MD5 446c8953004714d47ed75b7cbdf49042
SHA1 0911633420d4bb9658c2390c129426ca7fdbb060
SHA512 c10c72f29058cb1fa00c186fc3f10997a17b794ec453a08f9acff898943fac911ca59c94583ec9c6832edbe4c1953ad83d9cf8aac25e13b0686b6e36f14733d1
TLSH
T1E0D0C95F1986CB48280384A70BBB1057AEB549977A552A8C8A8E44FC918D41DFCAF701
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4820_478225752\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

84844b4b-49e1-4e3e-9bae-df1e260ef83a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4820_859536301\84844b4b-49e1-4e3e-9bae-df1e260ef83a.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GMCRY.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GMCRY.lnk
Size 810B
SHA256 317f218843ab1cef04d2946693ac5c054aa4f7dc2f2b416ad712ff22dda6cd40
MD5 eeb3f7fc5f10d3c0cbeb5091db3a69eb
SHA1 f7e326877788ede0928354850126ba46909ce0fd
SHA512 a80f9303253fd72a4608c6d0760ab44157c3d4d5703a0f2be5f34d79fdf8b4b24760ee295db18ec91099d44efb351b03514420def8856c38ef24a0dbc1ab828c
TLSH
T113019E584D561B31D6F1CB7083D65322C6352C42FFE61F06408281493468E11FDE5F2F
MD5 SHA1 SHA512 TLSH

Submit Download

GMCRY.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GMCRY.vbs
Size 115B
SHA256 9ed9165c925eab3497b86141896be15ea1e32f7605d7f908edde47b89a657208
MD5 c0307f4ea69a7c1e64857c90dd187127
SHA1 84d03d1cdb0e3be48c12c3b0eb88b5720ba0abcb
SHA512 d06a7d9bc8b9e5ea7c4d59ac8adea05b5cabe8f9744e6d1fefa19eb3c8d93fb146f1b08d9f4486cb7b403cf639356f0883883b8799cc2193a84e26a1fcc1a0c9
TLSH
T160B01205DC9CC51D640AC1F30BB1910E8BF5966165166C588B10C49C7348458AB27223
MD5 SHA1 SHA512 TLSH

Submit Download

ApproveEdit.gmcry

Path C:\Users\Admin\Desktop\ApproveEdit.gmcry
Size 11KB
SHA256 49bc97d4114794527777474d360d31c54ba2765e348fa70ae5049076e162ec04
MD5 003d0baed990511b80bb4ff9b7fa61fe
SHA1 4a08fbe587f8b7153c04f87d85c43cf999e8dbbb
SHA512 d7cfc832d37ac3246eb0c11d23dd3cb9454010d8532002da8bc749c0dadab2de9ce91fdf5599839c36ed020b4fd9ea06142ae0996b93c276dfd39bdf3b3458c7
SSDEEP 192:glmm0iAryyfHLSiYb8OWaG8hoHmkLHVg9BxF/jSidWIQhbxb24R:gQm0F+yfr0bjWaG4oGSgNFrSid5Qhtz
TLSH
T19C32CF4A60C956FD494E72DF8E6DBA74A1F744CF1A332B3B050521A06C883C6F105FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CloseNew.gmcry

Path C:\Users\Admin\Desktop\CloseNew.gmcry
Size 716KB
SHA256 7e2fa1fd21400a4d32f5f8e5ba1b60d7804476b93968e67eaa9ad7f0a2604967
MD5 7a127a7d862475b00b164f21309eb85e
SHA1 e9349ed76016243b6d1d14dffba9411f0922459a
SHA512 e5a816ea9d1ed956df8ee928a5257f3f18e9731afde50c3df5c6d58ea321a9ef6477e1539dc84694fa0b9f8a4d52fa8ee1826b665a818b0309bdb8f87b2d886b
SSDEEP 12288:8IctUCiNcsEtBD/2lVnAMOO6n7nC9tL5LGQg2AzzWCLH81jRwlrfOyfRutK9Qqo5:8htdsE/uLNeELRGQ0J8rEfRuQjoj9XX
TLSH
T1CDF423D127308ECA31EE8BE477450DDDCF7C10A04DF255BC9C5C2989BB68AA53492A6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompressSync.gmcry

Path C:\Users\Admin\Desktop\CompressSync.gmcry
Size 369KB
SHA256 c3cbff96c712ed096affabf56cf1b427abaf2fec75d5d29dd4b0f9e58d4cd779
MD5 854fa18352e37c4a5c18cad88e15eb62
SHA1 505595361efe25f89609cb3f464828cb5ce8b1f8
SHA512 e84273dadf5291caed754d32b846b2076f1afd80ef2c89aec42da77f9f0d57e65cfaa05578687f7043309dfcf4b83d29954396bc2fad412cebe6f4d9d2289725
SSDEEP 6144:xJLohBDbsOA7Ic3ynur51A+zj3uwgb3LEB3qQPe9LwTh8XPcDItKMPtwNw8QXO8d:xJkhhbsOAh3qu91AO3uwgb7ErPeJwTGX
TLSH
T15E8423FEE5045421E5B2A7075CA8FF508F1B91BE6D6FC39CA620479046EC2A176F0F61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GMCRYDecryptor.exe

Path C:\Users\Admin\Desktop\GMCRYDecryptor.exe
Size 14KB
SHA256 6fae846268980b6b91cc6d4a01573816b75dfe4210e8ab213ce157727b2d946d
MD5 ed651caec8d6da13c46d5fe10b84eecd
SHA1 f7244455493743b5e0bc6d53737d5f74725364c0
SHA512 29dd7ab4254b397d9d5ae4f3861d8e1e42946c066e25613f84a0bf6ea6a8a6a1a5653c76393d353b150a04c05d1f98578a062855feded2b5596b045916dfc438
SSDEEP 192:TfPpOSacc3DnoXIjzBu4ba6R9LBJjamAcqsa/9VAFC30euAXWg:TAiXIjzbf9LG/RVgWYAXWg
TLSH
T14362A704ABFCCA05F9BF4ABA8E7382008B31F886D971C75F0645448D1973B558EE5BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PopRedo.gmcry

Path C:\Users\Admin\Desktop\PopRedo.gmcry
Size 531KB
SHA256 bed66b7c876afdfe36c9f6532b6a6848d6b1cbf8ecc39ff35e98f133a818916b
MD5 926d13df1973f0a90f6716b2adba6c3d
SHA1 b82d656b5708a92b1674007297987035033c7e6d
SHA512 464435f206c88ba95f25b9e7b028f1c79b9b7f43b4eb5eb96c502cfe08f290932954e4431e77920a9dff7df10f3585a537cb0f1d92b4b94930284baabe551a83
SSDEEP 12288:jWSOsl0EcIjSZlySJXPyrgdfnIWe70BRn+xLrNYD62t8ape/obmhzr:jWO47/JXPyAe70z+FhYHtYNJr
TLSH
T1D6C4236E7E46979BB1F60ACAC9DE2901077D5D85EC8D2BC1803FA88C2D80CD5B7E4B45
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README.txt

Path C:\Users\Admin\Desktop\README.txt
Size 610B
SHA256 c39ad22180533379feb522b11a582817296f4b4eb12681080202b7f94c9284e7
MD5 ed5679963b74e1d03b879eb126ed09d4
SHA1 1b382d7220acab2195fa00243b877aa6f5d587a8
SHA512 7c81524d7cd00226556789bfdb65895f8b7860d46f1643b3499a0f6b708f43ccc6dd9da9b5f8191646741d506378f3983428d67e2df90fc94226a73377c0b344
TLSH
T12EF09E3FBF6D552062D141A37777F9A2AE1BC10C204CA264A8EE909833FD3258192574
MD5 SHA1 SHA512 TLSH

Submit Download

RedoRename.gmcry

Path C:\Users\Admin\Desktop\RedoRename.gmcry
Size 785KB
SHA256 2b6cbc7796aed39a0f0d2c453f64633994342aa4a83eca19ad6c22e207cb86e1
MD5 d41322436456743a90170a19dd4f0eb6
SHA1 44803adc2e5a4229a7e97d577f65675a2f0be050
SHA512 83948af6779247b31e88a55791de7b03a0d5cb37d3d1455beed5095665cec7b657a68b3d1c345f8564e69597a1521c5a3a76c92257a180e42f39a02287075f11
SSDEEP 12288:VwPKLyMYuiX7QUIfu3eRN8Q4RsFmeb+z7+2IxGeRx2rInNDZ:eeyMxiX7FI38Q4RQh67+2teRkrInP
TLSH
T1C005234EB9734C5974CB84C1AF87B09995DE86B21391B0CE1A7513022AF1F6AC245FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairExport.gmcry

Path C:\Users\Admin\Desktop\RepairExport.gmcry
Size 670KB
SHA256 e7fb94377f9e49f719000640dfa92b38eb14379afb7d7f3aa7aacbb53f0b27c9
MD5 f87da52fafc98a28b0f59db956c616e9
SHA1 f93dcd8b981e9287c63d26d487d24c64639e9e25
SHA512 10b4ff54888ef6d6d4f27d3b9bd9403b11d149595e56acdef3c6a3f4afcf48c013c3b41af5afcf95a572ca1f18296a1f25d0ce44a2e96240e91f60097c7d610a
SSDEEP 12288:oicTpNJ8TIIkkqvDiACLy7ywWHC6ZqfVnVCgWQrnXoCV3eRg0HgZLoc4lSe:DcVWYkq2ACwIqfBLFrt3y0LodAe
TLSH
T138E4237D980C1D3DFC6AF81EC2611E127509233A7BE6928DE8DEF8711642AFAB431175
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResumeSkip.gmcry

Path C:\Users\Admin\Desktop\ResumeSkip.gmcry
Size 416KB
SHA256 45c1fe59719e6bb65c3611b9bf8df1ca1e34fe345ababc347ba8d4de3f278725
MD5 8b8fa092c4cd8a4c269b100de2121ad9
SHA1 259a95596c4aa5e45a816ed2c55d3f3676d975f4
SHA512 0977c7d4d2d1248f06142fbb150afe58a392aa897882019e4eb7f444738415ae1513bd51291bf4a3b07f8fe98ba2687f8c2cd2f4f75965c249fc53890baeeb0f
SSDEEP 12288:uka26iNyvjRuD9TaTNomEIbXkkpZa+PL3zn5MWO7uN:M26iwRuD9TgKkpZa+n5MnE
TLSH
T19E9423577292BE34FF4AB7F086812967EC6C4E0241FB6D643F2985373D469452E29BC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoSync.gmcry

Path C:\Users\Admin\Desktop\UndoSync.gmcry
Size 508KB
SHA256 887b762e86d2734a1236e4d7eb199027159efe18110606041d59e0490bc5347a
MD5 010630890b145ed3ae3939f1c724f5ad
SHA1 658f09c6aca604b34171d352ff7d5224d636135c
SHA512 6fc31d221e439de02f9e9f0e9342c93a0d13c965a4510bf48d4fba44ed1407f314a5a1cfc15928dbed88b74485b229d2a7029a23aeeebbe8d9d859d507e951fb
SSDEEP 12288:O6J6UMDsnFCHnvKAWxvGYJGN6abNmcqdjQ7U1BNmkPtOZ:P0UG4FBJGZNmnZQg1rmbZ
TLSH
T116B4234E9D510C2B67281FEC222B6FD85491270F32DE45D234F16519BBA138F868EBBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateConvertFrom.gmcry

Path C:\Users\Admin\Desktop\UpdateConvertFrom.gmcry
Size 323KB
SHA256 eedc213ede02f5222fd56af68cd06526917f0549fe1edf972a80f05e965ee63d
MD5 5dc70dad2f7a1700807c5c06f76e4294
SHA1 fc76b90e2efbc2d64ef7300dff624d8fce41252d
SHA512 9045e5301a847a422e2ac7f51b7c4889964849b444c053d1554218b4198377fc8a2afd61a0674aafc19177769e35229582ff947cac76f10e56318780c07ca2fc
SSDEEP 6144:0NiUfUpLYTPFL7ofTTOwl+uNiMxupqVvLSosaJ32gEp4N8ehB9cfNAE:iTUpL07orTOwlfisupj3axOpa86Sfr
TLSH
T1B164233CC95491CE746DC85DFB5823D77EC6E8F3EA076540A83844A3F1DFA988864A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UpdateStep.gmcry

Path C:\Users\Admin\Desktop\UpdateStep.gmcry
Size 16KB
SHA256 85025894f0f43339866d75324ea945691625a894e9c6528d64319f1ae6fff96d
MD5 2823ca76b22720eb2b259f5f8684dffa
SHA1 7133ab125e635d7a1129cb10684d0bf758664bca
SHA512 d2f22d3c68c68677f599b46a5aa8094f8238c0e0a6ea8fdbc06bed6edfaf251ff4a903f15e212112d273b91a48f92d61e25d25cf78ba91fd5f626a077bc55e65
SSDEEP 384:vTU4J3eoIfJ0QRRp0mmN1RrB2Mr+FTKSI+:BeowJ0Qvp0vNfrxq
TLSH
T15B72D0141C7B381B8CB78980D2226E2A549A43DBC522C972F9CD49C1273ED05AFDB5EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ConvertFromCompare.gmcry

Path C:\Users\Admin\Music\ConvertFromCompare.gmcry
Size 737KB
SHA256 493782c3076063f120f97aa1db27370980d1578caa6125b711015b77c497c4e9
MD5 a54cbdd5f303a8ab8b6c344afd4a99f6
SHA1 77a18622dc8aa130ef421a7250ed83be09aa324a
SHA512 514ad902ab7b066ecdf4082c336a71e4b45cc6c26fd7729649448d0c7bfe80229603b70f238dfc1d12723bb946c83c98a7509ea95bbfb073015d10d5a346db42
SSDEEP 12288:R7d+/ppmx4x9GLnpHXcKA2oYTAIlng8lutaqyPKF5z8yCdladNGwl/YDTb9:lQxpmyCnVXcKAlIjLqVzzCdlzw1YR
TLSH
T161F4231EA341710592F97E8CFBBE41AD395C2F44BD0A792C979B274D0C285B9A3A3C71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountOpen.gmcry

Path C:\Users\Admin\Music\DismountOpen.gmcry
Size 614KB
SHA256 226db804bb987566ceefb42ed344c3c864a39ac5741699685a192a92163c6fa0
MD5 03a4d3cd1e2b2f552cd2fe37d625c8d0
SHA1 25392a4268dab1fb7023182805b3b73459fd29ff
SHA512 0851eacf1e934c711a079cc8e2273ac511c03dab00166ee12fb9dcd77ab652a9d9e69d452817e07dab723cdfdfaf481c7ddaedbadda01558bf554bff1412de8e
SSDEEP 12288:KNysIy2bIF06/ekVxAdsREHwAY7Y9tNQqBr6Z2LlSjCzxBqkpGGPRr0zysMvX:ntIEkLT+tNQt2UjCzHqMFizysC
TLSH
T18BD4235AAA13EFAC500D5C95C8686FB105D5D4120E23CAEF1E2709F96CAFBD20C56AE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OpenUnprotect.gmcry

Path C:\Users\Admin\Music\OpenUnprotect.gmcry
Size 307KB
SHA256 1c0a2332258ba521771371bd0abd9d7cea0818f19d86330c20be9810cdd2c565
MD5 072af8fa44fe92d707d3d7ac7366d45b
SHA1 cf111658f0cfdc140c09ad4be715738b542c366f
SHA512 1e1626f5ca00890e353f7867b40d1f42ed9eccee3d72aae6af01af13451c565eb4fa921943d56565717ee3ee439ea829510ffef6b1872c917e04cba81068bf38
SSDEEP 6144:r7Y7YO+vCf+GVZu1trwETotsKfmdOoFS+go+jgK1g5KDaOC4cUl/bH1ZZteo:r7Y7YO+ajVZu8DWKOsoFSZoFK1S1nWlN
TLSH
T11A6423EADD8EAC401EC8952F3F18EBDE00A61564A1E0655EF4C783F641D6182BCA2F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SavePush.gmcry

Path C:\Users\Admin\Music\SavePush.gmcry
Size 552KB
SHA256 ed1666d3e34cdac469bb23738630d870118245cbb948003db30d0b284509cf7e
MD5 2e7ea12ec668e41a1e2cb593cd6bd299
SHA1 85c0efc0caf39cf95a7b707c10afe20da3ca5dba
SHA512 b35ef9773b606c1347c2dbd75fc5bfb3be3e3a5431dc5c32abe449d0907a22a8ec015b5a32f288f24a2a35c84e4d847087198c38c6306c064a9d80bc09bc827f
SSDEEP 12288:TGcSzAREa3jNh7l7ExZPMDZIDq71x0pFEi2PRVHlpZlGuSw2f0f:C7zAREaHSWZI2R2pFBQFlU2
TLSH
T128C423C6D6FD2E2CE7B648B1DE638841C5D72FD656D8816F88C7A3C152069B3C4BA213
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BackupFormat.gmcry

Path C:\Users\Admin\Pictures\BackupFormat.gmcry
Size 1.7MB
SHA256 fc6c48ece2a8666eff309c3fdab26134bc24950159e754f688f25b0943039cca
MD5 6ceb03b18601e1582e2d28cbfc52c834
SHA1 f77cab0d264354f27af716d40f0d2052619bfedf
SHA512 83f0220bc2c61de41d6e529c876cb416ea38bcfee72acefb7c3dac72609a180a4e928584a912946f643d55cf660118e656c117e7c69f01f6121aa0afa9907e3d
SSDEEP 49152:VX94d8VMgFbTvKDY2LUZ3l8zs7+72IuaQ:1+KVMAKk2G3l8+T
TLSH
T1C785336DFD810703B93DD5E514209B0588B666B7AB0832DBAFA00B83452D15FA1F5BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompleteWatch.gmcry

Path C:\Users\Admin\Pictures\CompleteWatch.gmcry
Size 1.3MB
SHA256 e5e17c8b0559b3fa1bb357cd78f9e6b012eecd9fccf9910bc31c60a0b67bd551
MD5 a403fb72e014d530bdbd9bbaa62a8190
SHA1 0fe9f9db8e84c29a2d361c45314151dd22a15db6
SHA512 7c9b1cede2bfe46957c397b1c37d2f8136e3d56714a8c791d5115018ffd2de5879ca8545c8d72c568ccd758f808152ef18fb0dc08dd63844b4211d7039d64abb
SSDEEP 24576:7HnvgZGElk2LBQgx9ohB8hygUopM1xIp52Gc+f7lZzPA1eVpFdO:7H4Z+YqhOUOexGXzYkdO
TLSH
T17255334B8DC5A9C8B62F1E39E0819AC2E8F28919E4FB5057C70F9CF27E63A415F4B544
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KgXSsEqcx.gmcry

Path C:\Users\Admin\Pictures\KgXSsEqcx.gmcry
Size 24KB
SHA256 4751012954619d6502d860089277dbacec3505cae0093973ee5219057bf9098b
MD5 014888e2bfd89ea82e658a92c37f0eea
SHA1 541d59c61b7f3e9f83cff6ad87677a9a624205cb
SHA512 a95a93aea0ecab6fe2d63af64ede18f01c386110d896d412f3466b58d3a149891f1275ed4c2ae08599ba6006e53b2fecf2a333551f1ab11ad95bc36d00faebbd
SSDEEP 384:JprVwbCh3M4DCByuHFtGvFjJsHO3piLD8uglCIhMnVLsh9WgKmxpTl7qm5i5eLqU:JDUCh84ORzGEH+g0ug1AVovH7eYBqI
TLSH
T1B8B2D10ECCFE94B924AD94763923CB6F8DC95F54F9D9BA0C27382741ED18940E6B29C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchResume.gmcry

Path C:\Users\Admin\Pictures\SearchResume.gmcry
Size 1.6MB
SHA256 46cf431664444b8f19eb00879485e537606320ab067e2cc60bc7c0376b72110e
MD5 a8726387bb22d463d5774294a8d7c689
SHA1 ccfd0e3588bf691bbe7431c1fe000ef4cf36daa1
SHA512 5f1c03ba414e69600ba59da90fbbc69c16d5c9e7fab592d0af0f73022479632efbfbd9377e5b189a94ba0a79d8cddfb9328523f55004c3d73665678c9c612b46
SSDEEP 49152:kzEbPv09qe/pkgCB6N/22Ahh9JuV21+WcQ5:IEbPvuqYa1B6hDAb9AV2/5
TLSH
T16975338A47BA4BA8227D7F88D0DE03B26DD5956D696B3C8B7144ED3B5A203F03D06750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StopConvertFrom.gmcry

Path C:\Users\Admin\Pictures\StopConvertFrom.gmcry
Size 2.5MB
SHA256 e4318d1ac36c8b2bd49e6ee5e769b9b4c01ec88d118c2d7c8109978c83d28f83
MD5 f49268ee9dd5fcb6d11905019f16bba4
SHA1 7299903800e45b0849a2b3c06253b6a8ea0cc5e2
SHA512 46dcfb5129b9b00fecd70d69568de0fe3403fb24d36946bf7e2f5593ec37a5b8b804a73dc859cc8bca49a94449dd149ac36014a97728e46640015211e429b309
SSDEEP 49152:MOaKq+ytWMUlfMg0CtjcbQ6h+81bceLqbYbepPapWDFHwl/SnOfqrShlC:MO2Xul6e6h+8CgqsepPjQxSnOS2m
TLSH
T144C53365A0D4BA2E597077E8A0713A9F9E581B2B74FF2DC63134070DA9B07C81A13DE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SyncUnprotect.gmcry

Path C:\Users\Admin\Pictures\SyncUnprotect.gmcry
Size 1.1MB
SHA256 4bd752fe9233eb7e7b28879ca537b05c97e8406cd90f9134326e115e5e4a6081
MD5 9f647abf79554ea2d80eb4d668c60350
SHA1 9ac04aa3a6acc5b8f35aed2ac7f99ffa82829f6c
SHA512 1587ef51afddbf77f6ec69e7eff96cb6b670a69c8f0b362a351d3724fb099861bef0c7ecf3413d36c636d9c88bb80d507a62a17e2ed796120268b8e0cd503ab9
SSDEEP 24576:p+5K/TBk9cOTxXhc2IO8e4FSXS6yiKAQcl02h328XyL1ikiTe4RbQUA6HN1:p/TFO5hcNO8QzbK1cy2Q31WeR0t1
TLSH
T1263533112D922A731FC684D56E0AAB602FF63DD7C35613E92D4F61D1AAA0CED0BDB5C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2956-30-0x0000011A20BE0000-0x0000011A20BE1000-memory.dmp

Download

memory/2956-29-0x0000011A20BE0000-0x0000011A20BE1000-memory.dmp

Download

memory/2956-31-0x0000011A20BE0000-0x0000011A20BE1000-memory.dmp

Download

memory/2956-27-0x0000011A20BE0000-0x0000011A20BE1000-memory.dmp

Download

memory/2956-22-0x0000011A20BE0000-0x0000011A20BE1000-memory.dmp

Download

memory/2956-33-0x0000011A20BE0000-0x0000011A20BE1000-memory.dmp

Download

memory/2956-23-0x0000011A20BE0000-0x0000011A20BE1000-memory.dmp

Download

memory/2956-21-0x0000011A20BE0000-0x0000011A20BE1000-memory.dmp

Download

memory/2956-28-0x0000011A20BE0000-0x0000011A20BE1000-memory.dmp

Download

memory/2956-32-0x0000011A20BE0000-0x0000011A20BE1000-memory.dmp

Download

memory/3820-3-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Download

memory/3820-1-0x00000000052F0000-0x0000000005894000-memory.dmp

Download

memory/3820-34-0x0000000006430000-0x000000000643A000-memory.dmp

Download

memory/3820-0-0x0000000000220000-0x0000000000236000-memory.dmp

Download

memory/3820-2-0x0000000004C40000-0x0000000004CD2000-memory.dmp

Download

memory/3820-126-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Download

memory/5828-1931-0x0000000000780000-0x000000000078A000-memory.dmp

Download